All You Need to Know About Public Trust for TLS/SSL Certificates

Certification Authority Browser Forum (CA/B Forum)

The CA/Browser Forum is a voluntary organization of certificate issuers and suppliers of internet browser software and other applications that use certificates (certificate consumers). As a founding member of the Forum, Entrust actively contributes to developing industry standards known as Baseline Requirements, for the issuance and management of publicly trusted certificates.

The CA/Browser Forum is responsible for implementing new rules and policies that certification authorities (CAs) like Entrust must adhere to, as well as establishing regulations for CAs and their audits by third-party programs such as WebTrust and ETSI. In addition to the Forum, rules come from browser root program policies from browsers such as Mozilla, Microsoft, Apple, and Google. CAs must undergo annual audits to ensure they comply with standards, and the audit reports are shared with browsers. Any issues found must be addressed, potentially leading to certificate revocation. The Forum, as a standards-issuing body, does not enforce requirements and lacks the authority to make exceptions.

The requirements of the CA/Browser Forum evolve in response to the changing threat landscape and new technologies, and the organization enforces these requirements, with certificate consumers such as web browser vendors and email clients playing a crucial role. While not all changes originate from the Forum, they eventually become adopted, as CAs such as Entrust must adhere to them to retain support in relying party software.

Validity Periods

The CA/Browser Forum establishes TLS/SSL certificate validity periods through a member voting process outlined in its governing bylaws. Since Sept. 1, 2020, maximum certificate validity is 397 days, or approximately 13 months. The upcoming introduction of a 90-day or even 45-day certificate lifespan, as per Apple’s recent proposal, will be a significant shift for many organizations because it makes visibility, control, and automation more critical. Read our blog post and watch our webinar to learn about recommended next steps and how to plan your strategy before shorter certificate lifespans become the norm, with automation playing a crucial role in supporting this transition.

Revoking Certificates

The Baseline Requirements of the CA/Browser Forum establish a timeframe for revoking mis-issued certificates, which can be either 24 hours or five days, depending on the specific situation. The CA is obligated to conduct a thorough investigation of the reported issue and provide a preliminary report to both the subscriber and the reporting entity. After the investigation, the CA will work with the subscriber and any relevant parties to determine whether the certificate should be revoked and, if necessary, establish a revocation date. The CA is typically able to address the issue with minimal impact on organizations. A subscriber should be prepared to respond quickly to a CA’s request to revoke the certificate in a short timeframe to avoid any service disruptions.

Certificate Lifecycle Management (CLM)

Take the guesswork out of certificate lifecycle management

Discover, manage, and automate all certificates throughout your organization using an end-to-end, scalable certificate lifecycle automation solution. Take advantage of the simplicity and flexibility of our management portal that allows you to:

• Find unknown TLS/SSL certificates associated to your organization with our Discovery+ suite of tools and keep track of them from one centralized location
• Manage public and private certificates, regardless of issuing CA, from a single dashboard
• Streamline domain verification to the click of a button, after one-time setup with self-service that automates domain verification for you
• Automate certificate installation, deployment, and renewals from a simple, cloud-based platform
• Get insight with comprehensive real-time reporting and alerts to help maintain regulatory compliance and protect against unexpected certificate expiry
• Benefit from integration with third-party vendors, including ServiceNow, Venafi, Ansible, and Microsoft Azure

Certificate Automation

The Entrust solution provides customers with a variety of options for automating the certificate issuance and management processes:

• Automate your certificate issuance using the Entrust proven REST API, our industry standard ACMEv2 service, or by leveraging CLM platforms such as the Entrust Certificate Services platform or Certificate Hub.
• Simplify the process of continuously proving control of your organization’s domains by automating it separately using our REST API or our industry-first ACMEv2 preauthorization support. Customers also have the option to verify domains when issuing certificates on the fly via ACMEv2.
• Automate renewals and handle early emergency certificate revocations automatically with ACME Renewal Information (ARI).
• Know when automated processes may have stumbled, with monitoring, alerts, and notifications so you can be confident your certificates and domains are kept up to date, avoiding outages and operations emergencies.